0

Our client has recently stopped getting new orders placed on their Magento eCommerce site. Could this be related with the Poodle vulnerability, as their server is still on SSLv3.

Is there any specific log files I can run through to see what is going on, except the access_log and error_log.

1

If their server is exclusively on SSLv3, then probably not yet, but very, very soon.

Apple has disabled features of SSLv3 already. Mozilla plans to disable SSLv3 on Nov 25. Google plans to disable it by the end of the year. Microsoft may have already disabled it in Internet Explorer.

To test it, try disabling SSLv3 in your browser and connect to the site. Viewing the cert in the browser might be enough, depending on whether or not there are multiple certs or multiple servers involved.

Poodle is a MITM attack, it won't take a site down, it will instead intercept communciations between the client and the server. You may see nothing in the logs except an SSLv3 connection, as most browsers will use TLS 1.0 or higher.

Edit: Protocol renegotiation to SSLv3 should only occur between the client and the MITM, this wouldn't appear in the server logs.

  • On the last point: POODLE doesn't use, and won't be logged as, renegotiation. Especially if the server is SSL3 only as indicated by the question. At best the attack will appear on a TLS-capable server as an SSL3 connection from a client that could do >=TLS1.0, but how do you know that? serverfault.com/questions/637706/… says the only important browser that can't do TLS is IE6 on XP. – dave_thompson_085 Nov 23 '14 at 3:41
  • 1
    It's a good point, because the client starts the connection, the renegotiation is only between the client and the MITM, not with the server. You could see the user-agent strings for the SSLv3 connections, but now all SSLv3 connections should be considered suspicious. I'm updating the answer. – mgjk Nov 24 '14 at 16:16
  • in order to achive PCI compliance your client and Magento site may not use SSLv3 or even TLS 1.0, but TLS 1.1 or 1.2 – Elzo Valugi Jul 13 '17 at 8:50
  • @ElzoValugi totally correct (in 2017), but to be fair, the answer was from 2014. – mgjk Jul 15 '17 at 12:35
  • @mgjk you are right – Elzo Valugi Jul 15 '17 at 14:24

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.